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PURPOSE: To provide the user authentication system 
which can be improved In safety and operability than 
heretofore. 

CONSTITUTION: A computer system 2 is equipped with 
a user authentication database 2a, a database control 
part 2b which controls the user authentication database 
2a, a certifying service part 2c which offers 
authentication service, a ticket issue part 2d which 
issues a ticket having a time limit, a ciphering process 
part 2e which ciphers and composes information, and a 
communication control part 2f which transmits and 
receives information through a communication medium 
1. Computer systems 3-5 are equipped with certification 
request parts 3a-5a which sends certification requests to 
the computer system 2, service request parts 3b-5b which sends service requests to other 
computer systems, service parts 3c-5c which offer the service, ciphering process parts 3d-5d, 
Input parts 3e-5e, and communication control parts 3f-5f. 
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* NOTICES * 

JPO and INPIT are not responsible for any 
damages caused by the use of this translation. 

1 .This document has been translated by computer. So the translation may not reflect the original 
precisely. 

2.**** shows the word which can not be translated. 
3.1n the drawings, any words are not translated. 



DETAILED DESCRIPTION 



[Detailed Description of the Invention] 
[0001] 

[Industrial Application] This invention relates to the user authentication system in the security system of 
the network system which consists of two or more computer systems organically connected through 
communication media. 
[0002] 

[Description of the Prior Art] In recent years, two or more computer systems are connected through the 
commimication media of arbitration, and the network system which made the file and CPU of these 
computer systems available mutually is developed. 

[0003] There is much what consisted of such network systems so that a user might be attested in the case 
of the use initiation procedure of a computer system and the initiation procediu^ which starts various 
services for security etc. Conventionally, such a user's authentication judges authorization or refusal of 
use each time based on the user information which the computer system concerned itself manages [ the 
computer system used as the candidate for use ]. 

[0004] Therefore, when using service of the computer system of an and also [ authentication is the 
need ], from the computer system which performed alter operation, the information on a user name, a 
password, etc. which the user entered passes along communication media, and is transmitted to the 
computer system used as the candidate for vtse. 
[0005] 

[Probiem(s) to be Solved by the Invention] As mentioned above, the computer system used as the 
candidate for use is carrying out a user's authentication accompanying the use initiation procedure of a 
computer system etc. conventionally based on the user information which the computer system 
concerned itself manages. 

[0006] However, in such a system, since the communication-media top was flowed in the form which a 
user's information (a user name, password, etc.) can decipher for a third person, there was a problem of 
not being desirable on insurance. Moreover, when the user information managed for every computer on 
a network differed, the user had to change the user identifier (password) etc. by computer for use, and 
also had the problem that operability was spoiled. 

[0007] This invention coped with this conventional situation, was made, and tends to offer the user 
authentication system which can aim at improvement in safety, and improvement in operability 
compared with the former. 
[0008] 

[Means for Solving the Problem] Namely, two or more computer systems set this invention to the user 
authentication system of the network system which was connected through communication media and 
was mutually constituted available in the file and CPU of these computer systems. It responds to said 
network system from said each computer system at a user authentication demand. When a storage means 
to store User Information is searched, it judges whether the user is registered or not and the user is 
registered While establishing the computer system for authentication which enciphers and returns the 
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ticket which proves a user's justification with the time limit, and the password stored in said storage 
means It is characterized by establishing a cipher-processing means to encipher exchange of said User 
Information on said communication media to said each computer system. 
[0009] 

[Function] According to the user authentication system of this invention of the above-mentioned 
configuration, since unitary management of User Information in a network is carried out according to 
the computer system for authentication, a password etc. can be unified and improvement in operability 
can be aimed at compared with the former. 

[0010] Moreover, to commimication media, since the time limit is attached, the ticket which User 
Information does not flow in the form which can be deciphered for a third person, and is further used for 
authentication can also reduce possibility of being unfairly used for a third person, and to them, it can 
aim at improvement in safety compared with the former. 
[0011] 

[Example] Hereafter, one example of this invention is explained with reference to a drawing. 
[0012] Drawing 1 shows the configuration of one example of this invention. In this drawing, 1 is 
communication media and two or more computer systems 2, 3, 4, and 5 are coimected through these 
communication media 1. 

[0013] A computer system 2 among each above-mentioned computer system User authentication 
database 2a which is the authentication server which carries out package management of User 
Information on a network, and stores User Information, Data base manager 2b which manages this user 
authentication database 2a, Authentication courtesy counter 2c which offers authentication service in 
response to the authentication demand firom other computer systems 3, 4, and 5, It is a ticket used as the 
radical which judges a user's use permission at the time of service, and has 2d of ticket issue sections 
which publish the ticket to which the time limit was attached, cipher-processing section 2e which 
performs informational encryption and informational ****, and 2f of communications control sections 
which transmit and receive information through communication media 1. 

[0014] Moreover, the authentication demand sections 3a, 4a, and 5a which computer systems 3, 4, and 5 
are computers which a user generally uses, and perform an authentication demand to a computer system 
2, The service request sections 3b, 4b, and 5b which perform a service request to other computer 
systems. It has the courtesy counters 3c, 4c, and 5c which perform service, the cipher-processing 
sections 3d, 4d, and 5d which perform cipher processing mentioned above, the input sections 3e, 4e, and 
5e for a user to input, and the communications control sections 3f, 4f, and 5f which transmit and receive 
information through communication media 1. 

[0015] Here, procedure until a user starts use and starts use of service of a computer system 4 in a 

computer system 3 is made into an example, and an authentication procedure is explained. 

[0016] First, the user authentication procedure of the initial authentication at the time of use initiation of 

a computer system 3 is explained. As shown in the flow chart of drawing 2 , a user inputs a user name 

first to input section 3e to authentication demand section 3a of a computer system 3 (100). 

[0017] Authentication demand section 3 a requires the enciphered password which is registered into the 

computer system (authentication server) 2 in this inputted user name through communication media 1 by 

3f of communications control sections at delivery, a user's initial ticket, and user authentication database 

2a (101). 

[0018] In a computer system 2, the user name which received by 2f of communications control sections 
is inputted into authentication courtesy coimter 2c, authentication courtesy counter 2c sends a user name 
to data base manager 2b, and this user name confirms whether register with user authentication database 
2a (102). 

[0019] And if the user name is registered, by 2d of ticket issue sections, the initial ticket to which the 
time limit of predetermined time (for example, several hours thru/or about ten hours) was attached will 
be created (103), and this initial ticket and the password registered into user authentication database 2a 
corresponding to the user name will be enciphered in cipher-processing section 2e (104). Here, a time 
limit is imposed on an initial ticket for preventing the unauthorized use by the third person. That is, if 
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there is no time limit in an initial ticket, after a valid user's receiving authentication, publishing an initial 
ticket and using the computer system concerned, it is because a third person may use the computer 
system concerned improperly with this initial ticket. 

[0020] On the other hand, when the user is not registered into user authentication database 2a, it 
supposes that authentication is impossible (105) and these results are returned to a computer system 3 
through 2f of communications control sections (106). 

[0021] In a computer system 3, the result of 3f smell lever of communications control sections is 
received, and it inputs into authentication demand section 3a, In authentication demand section 3a, if the 
input of a password is demanded from a user from input section 3e and a user enters a password (107), 
in 3d of cipher-processing sections, the transmitting contents from a computer system 2 will be decoded 
(108), and it will judge whether these passwords are in agreement (109). Here, if a password is in 
agreement, a computer system 3 will become available and an initial ticket will become effective 
between the time limit. Moreover, using becomes impossible if a password is not in agreement. 
[0022] In addition, the protocol of the user authentication at the time of the above-mentioned beginning 
of using is shown in drawing 5 . In this drawing, the computer system 2 whose C is a computer system 3 
and whose AS is an authentication server is shown. 

[0023] Next, a user explains the case where service of a computer system 3 to the computer system 4 is 
used. 

[0024] As shown in drawing 3 , when a user inputs the purport which wants to use service of a computer 
system 4 for service request section 3b from input section 3e, it investigates whether service request 
section 3b has a certificate for service (service ticket) (200) and there is almost no service ticket, a 
service ticket is required from a computer system 2 (201). 

[0025] And when there is a service ticket, next, an initial ticket investigates ****** within an expiration 
date (202), (when there is no service ticket, after receiving a service ticket from a computer system 2), if 
it is within an expiration date, a service ticket will be enciphered in 3d of cipher-processing sections 
(203), this enciphered service ticket will be sent to a computer system 4 from 3f of communications 
control sections, and a service request will be performed (204). 

[0026] In a computer system 4, in communications control section 4e, the above-mentioned service 
request is received and this service request is inputted into courtesy counter 4c. In courtesy counter 4c, 
the service ticket sent in 4d of cipher-processing sections is decoded (205), and it checks whether you 
are a right user (206). And when it is a right user, the purport which receives service is returned, service 
is started, and when it is not a right user, the purport which refuses service is returned. 
[0027] In addition, the protocol of the user authentication at the time of the above-mentioned service is 
shown in drawing 6 . In this drawing, the computer system 2 whose C is a computer system 3 and whose 
AS is an authentication server, and S show the computer system 4 which gives its service. 
[0028] Next, processing of the service ticket demand in step 201 mentioned above and issue is 
explained. 

[0029] When it does not have a service ticket, as shown in drawing 4 , by the computer system 3, in 3d 
of cipher-processing sections, an initial ticket and the computer system name (computer system 4) to be 
used are enciphered first (300), these are sent to a computer system 2 from 3f of communications control 
sections, and issue of a service ticket is required (301). 

[0030] In a computer system 2, the demand of 2f smell lever of communications control sections is 
received, and this demand is inputted into authentication courtesy counter 2c. In authentication courtesy 
counter 2c, the data sent by cipher-processing section 2e are decoded (302), and an initial ticket checks 
the right or no (isn't it time-out?) (303). 

[0031] And a service ticket is created in 2d of ticket issue sections (304), and an initial ticket enciphers 
this service ticket by cipher-processing section 2e (305), and returns a right case to a computer system 3 
from 2f of communications control sections. Moreover, that is returned to a computer system 3 when an 
initial ticket is time-out (306). 

[0032] In a computer system 3, 3f of communications control sections receives a service ticket, and this 
service ticket is decoded and stored by 3d of cipher-processing sections (307). 
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[0033] Thus, since unitary management of User Information in a network is carried out according to the 
computer system 2 which is an authentication server according to this example, a password etc. can be 
unified and improvement in operabiHty can be aimed at compared with the former. Moreover, to 
communication media 1, since the time Hmit is attached, the initial ticket which User Information does 
not flow in the form which can be deciphered for a third person, and is further used for authentication 
can also reduce possibility of being unfairly used for a third person, and to them, it can aim at 
improvement in safety compared with the former. 
[0034] 

[Effect of the Invention] As explained above, according to the user authentication system of this 
invention, compared with the former, improvement in safety and improvement in operability can be 
aimed at. 



[Translation done.] 
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* NOTICES * 

JPO and INPIT are not responsible for any 
damages caused by the use of this translation. 

1 .This document has been translated by computer. So the translation may not reflect the original 
precisely. 

2.**** shows the word which can not be translated. 
3. In the drawings, any words are not translated. 



CLAIMS 



[Claim(s)] 

[Claim 1] In the user authentication system of the network system which two or more computer systems 
were connected through communication media, and was mutually constituted available in the file and 
CPU of these computer systems It responds to said network system from said each computer system at a 
user authentication demand. When a storage means to store User Information is searched, it judges 
whether the user is registered or not and the user is registered ^^^liIe establishing the computer system 
for authentication which enciphers and returns the ticket which proves a user's justification with the time 
limit, and the password stored in said storage means The user authentication system characterized by 
establishing a cipher-processing means to encipher exchange of said User Information on said 
communication media to said each computer system. 



[Translation done.] 
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* NOTICES * 

JPO and INPIT are not responsible for any 
damages caused by the use of this translation. 

1 .This document has been translated by computer. So the translation may not reflect the original 
precisely. 

2.**** shows the word which can not be translated. 
3. In the drawings, any words are not translated. 



TECHNICAL FIELD 



[Industrial Application] This invention relates to the user authentication system in the security system of 
the network system which consists of two or more computer systems organically connected through 
communication media. 



[Translation done.] 
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* NOTICES * 

JPO and INPIT are not responsible for any 
damages caused by the use of this translation. 

1 .This document has been translated by computer. So the translation may not reflect the original 
precisely. 

2.**** shows the word which can not be translated. 
3. In the drawings, any words are not translated. 



PRIOR ART 



[Description of the Prior Art] In recent years, two or more computer systems are connected through the 
communication media of arbitration, and the network system which made the file and CPU of these 
computer systems available mutually is developed. 

[0003] There is much what consisted of such network systems so that a user might be attested in the case 
of the use initiation procedure of a computer system and the initiation procedure which starts various 
services for security etc. Conventionally, such a user's authentication judges authorization or refusal of 
use each time based on the user information which the computer system itself [ concerned ] manages 
[ the computer system used as the candidate for use ]. 

[0004] Therefore, when using service of the computer system of an and also [ authentication is the 
need ], from the computer system which performed alter operation, the information on a user name, a 
password, etc. which the user entered passes along communication media, and is transmitted to the 
computer system used as the candidate for use. 



[Translation done.] 
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* NOTICES * 

JPO and INPIT are not responsible for any 
damages caused by the use of this translation. 

1. This document has been translated by computer. So the translation may not reflect the original 
precisely. 

2. **** shows the word which can not be translated. 
3. In the drawings, any words are not translated. 



EFFECT OF THE INVENTION 



[Effect of the Invention] As explained above, according to the user authentication system of this 
invention, compared with the former, improvement in safely and improvement in operability can be 
aimed at. 



[Translation done.] 
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* NOTICES * 

JPO and INPIT are not responsible for any 
damages caused by the use of this translation. 

1. This document has been translated by computer. So the translation may not reflect the original 
precisely. 

2. **** shows the word which can not be translated. 
3.1n the drawings, any words are not translated. 



TECHNICAL PROBLEM 



[Problem(s) to be Solved by the Invention] As mentioned above, the computer system used as the 
candidate for use is carrying out a user's authentication accompanying the use initiation procedure of a 
computer system etc. conventionally based on the user information which the computer system 
concerned itself manages. 

[0006] However, in such a system, since the communication-media top was flowed in the form which a 
user's information (a user name, password, etc.) can decipher for a third person, there was a problem of 
not being desirable on insurance. Moreover, when the user information managed for every computer on 
a network differed, the user had to change the user identifier (password) etc. by computer for use, and 
also had the problem that operability was spoiled. 

[0007] This invention coped with this conventional situation, was made, and tends to offer the user 
authentication system which can aim at improvement in safety, and improvement in operability 
compared with the former. 



[Translation done.] 
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* NOTICES * 

JPO and INPIT are not responsible for any 
damages caused by the use of this translation. 

1. This document has been translated by computer. So the translation may not reflect the original 
precisely. 

2. **** shows the word which can not be translated. 
3.1n the drawings, any words are not translated. 



MEANS 



[Means for Solving the Problem] Namely, two or more computer systems set this invention to the user 
authentication system of the network system which was connected through communication media and 
was mutually constituted available in the file and CPU of these computer systems. It responds to said 
network system from said each computer system at a user authentication demand. When a storage means 
to store User Information is searched, it judges whether the user is registered or not and the user is 
registered While establishing the computer system for authentication which enciphers and returns the 
ticket which proves a user's justification with the time limit, and the password stored in said storage 
means It is characterized by establishing a cipher-processing means to encipher exchange of said User 
Information on said commimication media to said each computer system. 



[Translation done.] 
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* NOTICES * 

JPO and INPIT are not responsible for any 
damages caused by the use of this translation. 

1. This document has been translated by computer. So the translation may not reflect the original 
precisely. 

2. **** shows the word which can not be translated. 
3. In the drawings, any words are not translated. 



OPERATION 



[Function] According to the user authentication system of this invention of the above-mentioned 
configuration, since unitary management of User Information in a network is carried out according to 
the computer system for authentication, a password etc. can be unified and improvement in operability 
can be aimed at compared with the former. 

[0010] Moreover, to communication media, since the time limit is attached, the ticket which User 
Information does not flow in the form which can be deciphered for a third person, and is further used for 
authentication can also reduce possibility of being unfairly used for a third person, and to them, it can 
aim at improvement in safety compared with the former. 



[Translation done.] 
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* NOTICES * 

JPO and INPIT are not responsible for any 
damages caused by the use of this translation. 

1 .This document has been translated by computer. So the translation may not reflect the original 
precisely. 

2 **1.* shows the word which can not be translated. 
3. In the drawings, any words are not translated. 



EXAMPLE 



[Example] Hereafter, one example of this invention is explained with reference to a drawing. 
[0012] DrawingJ. shows the configuration of one example of this invention. In this drawing, 1 is 
communication media and two or more computer systems 2, 3, 4, and 5 are connected through these 
communication media 1 . 

[0013] A computer system 2 among each above-mentioned computer system User authentication 
database 2a which is the authentication server which carries out package management of User 
Information on a network, and stores User Information, Data base manager 2b which manages this user 
authentication database 2a, Authentication courtesy counter 2c which offers authentication service in 
response to the authentication demand from other computer systems 3, 4, and 5, It is a ticket used as the 
radical which judges a user's use permission at the time of service, and has 2d of ticket issue sections 
which publish the ticket to which the time limit was attached, cipher-processing section 2e which 
performs informational encryption and informational ****, and 2f of coramimications control sections 
which transmit and receive information through communication media 1, 

[0014] Moreover, the authentication demand sections 3 a, 4a, and 5a which computer systems 3, 4, and 5 
are computers which a user generally uses, and perform an authentication demand to a computer system 
2, The service request sections 3b, 4b, and 5b which perform a service request to other computer 
systems. It has the courtesy counters 3c, 4c, and 5c which perform service, the cipher-processing 
sections 3d, 4d, and 5d which perform cipher processing mentioned above, the input sections 3e, 4e, and 
5e for a user to input, and the communications control sections 3f, 4f, and 5f which transmit and receive 
information through communication media 1. 

[001 5] Here, procedure until a user starts use and starts use of service of a computer system 4 in a 

computer system 3 is made into an example, and an authentication procedure is explained. 

[0016] First, the user authentication procedure of the initial authentication at the time of use initiation of 

a computer system 3 is explained. As shown in the flow chart of drawing 2 , a user inputs a user name 

first to input section 3e to authentication demand section 3a of a computer system 3 (100). 

[0017] Authentication demand section 3a requires the enciphered password which is registered into the 

computer system (authentication server) 2 in this inputted user name through communication media 1 by 

3f of communications control sections at delivery, a user's initial ticket, and user authentication database 

2a (101). 

[0018] In a computer system 2, the user name which received by 2f of communications control sections 
is inputted into authentication courtesy counter 2c, authentication courtesy counter 2c sends a user name 
to data base manager 2b, and this user name confirms whether register with user authentication database 
2a (102). 

[0019] And if the user name is registered, by 2d of ticket issue sections, the initial ticket to which the 
time limit of predetermined time (for example, several hours thru/or about ten hours) was attached will 
be created (103), and this initial ticket and the password registered into user authentication database 2a 
corresponding to the user name will be enciphered in cipher-processing section 2e (104). Here, a time 
limit is imposed on an initial ticket for preventing the unauthorized use by the third person. That is, if 
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there is no time limit in an initial ticket, after a valid user's receiving authentication, publishing an initial 
ticket and using the computer system concerned, it is because a third person may use the computer 
system concerned improperly with this initial ticket. 

[0020] On the other hand, when the user is not registered into user authentication database 2a, it 
supposes that authentication is impossible (105) and these results are returned to a computer system 3 
through 2f of communications control sections (106). 

[0021] In a computer system 3, the resuh of 3f smell lever of communications control sections is 
received, and it inputs into authentication demand section 3a. In authentication demand section 3a, if the 
input of a password is demanded from a user from input section 3e and a user enters a password (107), 
in 3d of cipher-processing sections, the transmitting contents from a computer system 2 will be decoded 
(108), and it will judge whether these passwords are in agreement (109). Here, if a password is in 
agreement, a computer system 3 will become available and an initial ticket will become effective 
between the time limit. Moreover, using becomes impossible if a password is not in agreement. 
[0022] In addition, the protocol of the user authentication at the time of the above-mentioned beginning 
of using is shovra in drawing 5 . In this drawing, the computer system 2 whose C is a computer system 3 
and whose AS is an authentication server is shown. 

[0023] Next, a user explains the case where service of a computer system 3 to the computer system 4 is 
used. 

[0024] As shown in drawing 3 , when a user inputs the purport which wants to use service of a computer 
system 4 for service request section 3b from input section 3e, it investigates whether service request 
section 3b has a certificate for service (service ticket) (200) and there is almost no service ticket, a 
service ticket is required from a computer system 2 (201). 

[0025] And when there is a service ticket, next, an initial ticket investigates ****** within an expiration 
date (202), (when there is no service ticket, after receiving a service ticket from a computer system 2), if 
it is within an expiration date, a service ticket will be enciphered in 3d of cipher-processing sections 
(203), this enciphered service ticket will be sent to a computer system 4 from 3f of communications 
control sections, and a service request will be performed (204). 

[0026] In a computer system 4, in communications control section 4e, the above-mentioned service 
request is received and this service request is inputted into courtesy counter 4c. In courtesy counter 4c, 
the service ticket sent in 4d of cipher-processing sections is decoded (205), and it checks whether you' 
are a right user (206). And when it is a right user, the purport which receives service is returned, service 
is started, and when it is not a right user, the purport which refiises service is returned. 
[0027] In addition, the protocol of the user authentication at the time of the above-mentioned service is 
shown in drawing 6 . In this drawing, the computer system 2 whose C is a computer system 3 and whose 
AS is an authentication server, and S show the computer system 4 which gives its service. 
[0028] Next, processing of the service ticket demand in step 201 mentioned above and issue is 
explained. 

[0029] When it does not have a service ticket, as shown in drawing 4 , by the computer system 3, in 3d 
of cipher-processing sections, an initial ticket and the computer system name (computer system 4) to be 
used are enciphered first (300), these are sent to a computer system 2 from 3f of commimications control 
sections, and issue of a service ticket is required (301). 

[0030] In a computer system 2, the demand of 2f smell lever of communications control sections is 
received, and this demand is inputted into authentication courtesy counter 2c. In authentication courtesy 
counter 2c, the data sent by cipher-processing section 2e are decoded (302), and an initial ticket checks 
the right or no (isn't it time-out?) (303). 

[0031] And a service ticket is created in 2d of ticket issue sections (304), and an initial ticket enciphers 
this service ticket by cipher-processing section 2e (305), and returns a right case to a computer system 3 
from 2f of communications control sections. Moreover, that is returned to a computer system 3 when an 
initial ticket is time-out (306). 

[0032] In a computer system 3, 3f of communications control sections receives a service ticket, and this 
service ticket is decoded and stored by 3d of cipher-processing sections (307). 
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[0033] Thus, since unitary management of User Information in a network is carried out according to the 
computer system 2 which is an authentication server according to this example, a password etc. can be 
unified and improvement in operabiUty can be aimed at compared with the former. Moreover, to 
communication media 1, since the time limit is attached, the initial ticket which User Information does 
not flow in the form which can be deciphered for a third person, and is further used for authentication 
can also reduce possibility of being unfairly used for a third person, and to them, it can aim at 
improvement in safety compared with the former. 
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* NOTICES * 

JPO and INPIT are not responsible for any 
damages caused by the use of this translation. 

1 .This document has been translated by computer. So the translation may not reflect the original 
precisely. 

2.**** shows the word which can not be translated. 
3.1n the drawings, any words are not translated. 



DESCRIPTION OF DRAWINGS 



[Brief Description of the Drawings] 

[Drawing 1] Drawing showing the configuration of one example of this invention. 

[Drawing 2] Drawing showing the procedure of the user authentication at the time of the beginning of 

using in one example of this invention. 

[Drawing 3] Drawing showing the procedure of the user authentication at the time of the service in one 
example of this invention. 

[Drawing 4] Drawing showing the procedure of the service ticket issue in one example of this invention. 

Prawing 5] Drawmg showing the protocol of the user authentication at the time of the beginning of 
using. 

[Drawing 6] Drawing showuig the protocol of the user authentication at the time of service. 
[Description of Notations] 

1 Communication Media 

2 Computer System (for Authentication) 
2a User authentication database 

2b Data base manager 

2c Authentication courtesy counter 

2d Ticket issue section 

2e Cipher-processing section 

2f Communications control section 

3, 4, 5 Computer system 

3d, 4d, 5d Cipher-processing section 
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